Privacy Policy

Alice Care ("we," "our," or "us") is committed to protecting your privacy and the confidentiality of your health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and web platform (collectively, the "Service").

1. Information We Collect

1.1 Personal Information

We collect information you provide directly to us, including:

• Account Information: Name, email address, phone number, and role (parent, caregiver, healthcare provider)
• Profile Information: Profile photos, communication preferences
• Authentication Data: Login credentials and multi-factor authentication information

1.2 Protected Health Information (PHI)

As a healthcare application, we collect and process PHI in accordance with HIPAA regulations, including:

• Patient Demographics: Name, date of birth, allergies being treated
• Treatment Data: Dosing schedules, dose logs, treatment protocols
• Medical Information: Reaction logs, symptoms, severity assessments
• Clinical Notes: Healthcare provider observations and recommendations
• Appointment Records: Scheduled visits, updose appointments

1.3 Automatically Collected Information

• Device Information: Device type, operating system, unique device identifiers
• Usage Data: Features accessed, time spent in app, interaction patterns
• Log Data: IP address, access times, error logs (for troubleshooting)

1.4 Community Content

When you post in the Community feature, we collect and store:

• The text of your posts and comments
• Optional metadata you select (treatment phase, allergen, post type)
• Whether you chose to post anonymously
• Reactions, likes, and replies
• Moderation flags raised by automated systems or other users, and associated review actions

Community content is hosted by Stream / GetStream on our behalf (see Section 3.3). Posts you make may be visible to other users of the Service. Do not share Protected Health Information or personally identifying details (yours or anyone else's) in community posts.

2. How We Use Your Information

We use the collected information for the following purposes:

• Treatment Management: Enable tracking of OIT doses, reactions, and treatment progress
• Care Coordination: Facilitate communication between patients, caregivers, and healthcare providers
• Clinical Alerts: Notify healthcare providers of concerning reactions or missed doses
• Appointment Management: Schedule and manage clinic visits and updose appointments
• Service Improvement: Analyze usage patterns to improve the application
• Security: Detect and prevent unauthorized access or fraudulent activity
• Legal Compliance: Meet regulatory requirements and respond to legal requests
• AI-Powered Features: With your explicit consent, process treatment data through third-party AI services to power the Ask Alice chat assistant and generate treatment summaries (see Section 3.5)

2.5 AI Processing

The Service includes two AI-assisted features that transmit a limited subset of your information to a third-party AI provider:

• "Ask Alice" assistant. Powered by a third-party AI provider. Each request transmits the parent's typed question, the treating child's first name, the allergen, the current dose, the treatment phase, and the protocol level. The response is returned to your device and is not used to train the underlying model.
• On-demand treatment progress summaries. Powered by a third-party AI provider. Each request transmits the child's first name, allergens, current dose, treatment phase, current protocol level, aggregated compliance metrics (missed-dose count, streak, average dose time), and recent reaction summaries (count, severity, date).

We do not transmit last names, dates of birth, addresses, phone numbers, email addresses, or other directly identifying information to the AI provider. AI features are disclosed at first use within the relevant in-app surfaces.

3. Information Sharing and Disclosure

3.1 Healthcare Team

Your health information is shared with your designated healthcare providers (doctors and nurse practitioners) to facilitate your OIT treatment. This sharing is essential for proper medical care.

3.2 Caregivers

Parents/guardians may grant access to designated caregivers with either view-only or edit permissions. You control who has access to your child's information.

3.3 Service Providers

We share information with the following third-party service providers who assist in operating the Service, subject to confidentiality agreements and, where applicable, HIPAA Business Associate Agreements:

• Cloud hosting providers (Firebase/Google Cloud Platform)
• Authentication services
• Analytics providers (anonymized data only)
• AI service providers (Google Gemini via OpenRouter) — see Section 3.5 below for details

3.4 Legal Requirements

We may disclose information when required by law, court order, or to protect the safety of individuals.

3.5 AI-Powered Features (Ask Alice and Treatment Summaries)

With your explicit, opt-in consent, Alice Care uses third-party AI services to power the Ask Alice chat assistant and to generate parent and clinician treatment summaries.

• Named subprocessors (for transparency): AI inference is currently provided by Google Gemini, operated by Google LLC, accessed both directly via the Google AI API and through OpenRouter, Inc., which acts as a routing gateway. We may change AI providers over time; this list identifies the processors in use as of the date of this Policy. See Google AI API Terms and OpenRouter's Privacy Policy.
• Data shared with the AI provider: your child's first name, the allergen being treated, current dose and protocol level, recent dose-log history, reaction logs from the past 30 days, dose-adjustment history from the past 90 days, and (for Ask Alice) the question you type and the recent conversation context. We do not send your full name, your child's last name, date of birth, email address, phone number, address, or payment information.
• Purpose: To generate the chat response or treatment summary you requested. Data is processed only to fulfill that request.
• Retention by the AI provider: Our AI provider does not use API request data to train its general-purpose models. Prompt data may be retained briefly (typically up to 30 days) for abuse monitoring and is then deleted. Any routing gateway forwards requests to the provider and does not store prompt content beyond transient routing.
• Equal protection: Our AI provider and any routing gateway are contractually committed to confidentiality and data-security protections at least equivalent to those described in this Privacy Policy.
• Your control: AI features are off by default and require your explicit consent before any data is sent. You can revoke consent at any time in Settings → Privacy & Security → AI & Data Sharing; future AI requests will be blocked until you re-consent.

4. Data Security

We implement comprehensive security measures to protect your information:

• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Access Controls: Role-based access ensures users only see information relevant to their role
• Audit Logging: All access to PHI is logged for compliance and security monitoring
• Session Management: Automatic session timeout after 15 minutes of inactivity, with optional biometric re-authentication on supported devices
• Secure Authentication: Support for multi-factor authentication
• Regular Security Assessments: Ongoing vulnerability testing and security reviews

5. Data Retention

We retain your information as follows:

• Health Records: Minimum of 6 years as required by HIPAA, or longer if required by state law
• Account Information: Until you request account deletion
• Audit Logs: 6 years for compliance purposes

6. Your Rights

You have the following rights regarding your information:

• Access: Request a copy of your health information
• Correction: Request corrections to inaccurate information
• Deletion: Request deletion of your account (subject to legal retention requirements)
• Restriction: Request restrictions on certain uses of your information
• Portability: Receive your data in a portable format
• Accounting: Request an accounting of disclosures of your PHI

To exercise these rights, please contact us using the information below.

7. Children's Privacy

Alice Care is designed to help parents and caregivers manage treatment for children with food allergies. We do not knowingly collect information directly from children under the age of thirteen (13), and the Service is not intended for use by children to create their own accounts.

We collect information about children — including children under 13 — only with the verifiable consent of a parent or legal guardian, and only as necessary to provide the treatment management features the parent or guardian has requested.

Parents and legal guardians may, at any time:

• Review the personal information we have collected about their child
• Request that we correct or delete that information
• Refuse to permit further collection or use of their child's information by closing the account

The community feature is intended for parents, caregivers, and adult patients. Children under 13 should not post or comment in the community, and we do not knowingly permit them to do so.

To exercise any of the rights above, contact us using the information in Section 9.

8. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the new policy in the app and updating the "Last Updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

9. Contact Us